Security

Where your data lives

• The app and its database run in London. The Anvul servers are hosted in London (Fly.io, London region) and your firm’s records sit in a managed PostgreSQL database in London (Neon, AWS eu-west-2).
• Photos and documents (job photos, receipts, certificates, invoices as PDFs) are stored in Cloudflare R2 object storage.
• A few providers process data outside the UK — card payments (Stripe) and email delivery (Resend). The privacy policy lists them and the transfer safeguards we rely on.

Encryption

• In transit: every page, app screen and API call is served over HTTPS (TLS). Plain HTTP is not accepted.
• At rest: the database and file storage are encrypted at rest by our hosting providers.
• We never see or store card numbers — card payments are handled by Stripe.

Backups

The database keeps a continuous point-in-time history, so we can restore your records to an earlier moment if something goes wrong. We keep a written restore runbook and test it.

You also hold your own copy whenever you want one: Settings → Your data → Build my file gives you everything your firm has in Anvul — spreadsheets (CSV) of your customers, jobs, quotes, invoices, payments and more, plus a PDF of every invoice and certificate. It keeps working after you cancel.

Who can see what

• Your firm is walled off from every other firm. Each firm’s records are separated at the database level (row-level security), not just in the app.
• Inside your firm, seats see what their job needs. Engineers see their jobs and customers’ details for the work; they don’t see your costs or margins. Money screens are for owner and finance seats.
• Anvul staff only look at your account to help you (for example when you ask support to), and sensitive actions are audit-logged.

Signing in

• Anvul signs you in with a one-time code sent to your email. There is no password to guess, reuse or leak. Codes are short-lived and work once.
• You can sign out everywhere from Settings, which ends every session on every device.
• Two-factor with an authenticator app is not available yet. Because sign-in already needs access to your email, keep that email account protected with its own two-factor.
• When someone leaves, remove them from Team — their access ends straight away.

Report a security issue

If you think you have found a security problem, or you think someone has got into your account, email [email protected] with “Security” in the subject. A person reads it. Please include what you saw and when, and don’t test against other firms’ data.

If personal data is affected, we will tell you without undue delay and meet our duties to notify the UK’s data protection regulator, the Information Commission.

Who you are dealing with

Anvul Ltd, registered in England & Wales, company number 17111703, 16 Radford Road, Stoke-on-Trent ST4 7DA.